GHSA-hm9r-7f84-25c9
Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes
At a glance
- Published
- Updated
- CVE
- CVE-2023-47037
- Aliases
- BIT-airflow-2023-47037, PYSEC-2023-232
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Description
Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability.
Affected packages
| Package | Versions |
|---|---|
| PyPI · apache-airflow | introduced 0, fixed 2.7.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-47037 ADVISORY
- https://github.com/apache/airflow/pull/33413 WEB
- https://github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad WEB
- https://github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef WEB
- https://github.com/apache/airflow PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-232.yaml WEB
- https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0 WEB
- http://www.openwall.com/lists/oss-security/2023/11/12/1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |